clickjacking

Javascript to prevent clickjacking

由 谁说我不能喝 提交于 2019-12-13 12:51:18
问题 I have this Javascript snippet in my application to prevent clickjacking: <script language="javascript" type="text/javascript"> var style = document.createElement('style'); style.type = "text/css"; style.id = "antiClickjack"; style.innerHTML = "body{display:none !important;}"; document.head.appendChild(style); if (self === top) { var antiClickjack = document.getElementById("antiClickjack"); antiClickjack.parentNode.removeChild(antiClickjack); } else { top.location = self.location; } </script>

Overlay one iframe on top of another, scroll them together

由 本秂侑毒 提交于 2019-12-12 06:39:08
问题 Following up on How to rewrite URLs referenced by Javascript code? I'd like to overlay a button on top of someone else's website (e.g. overlay a Paypal button alongside Stackoverflow's bounty button) and have the two <iframe> s scroll together. The button would reside in the top layer. The website would reside in the bottom layer. I understand that transparent <iframe> s were/are abused for clickjacking but the browser security mechanism seems to block legitimate use-cases. In my case the

X-Frame-Options header on error response

由 ⅰ亾dé卋堺 提交于 2019-12-12 06:07:24
问题 I found an interesting bug report related to X-Frame-Options header. But I dont understand how this can be security problem. Following code is given as proof of vulnerability: require 'net/http' require 'uri' uri = URI.parse("https://play.google.com/#{"a" * 10000}") @r = Net::HTTP.get_response uri ret = @r.each_header {|x| puts x} if ret["x-frame-options"] puts ret["x-frame-options"] else puts "Missing x-frame-options!" end But it is trying to access an invalid URL (https://play.google.com

How does Clickjacking spread, in layman terms?

由 和自甴很熟 提交于 2019-12-08 05:00:30
I have been reading a lot regarding iframes and clickjacking, and was not able to find the information I am looking for. Can you help me out with below questions? How does Iframe clickjacking spread? I have seen lot of articles which mentions editing of html code in the local machine and by the same they are able to hijack users click by adding an invisible button. But, this is a modified logic on a local machine of a user. I am interested in knowing is it possible to push this same code to the cloud and impact every user logging in or using that portal? If yes, how? If I enable Iframe options

x-frame-option SAMEORIGIN and clickjacking in ASP.NET

由 微笑、不失礼 提交于 2019-12-07 02:19:26
The application had problems with allowing to be loaded into iframe. I have read a lot about it (and clickjacking). As it is necessary to load a page into the iframe withing the same origin, I have come to the following solution: Add the following to the global.asax file HttpContext.Current.Response.AddHeader("x-frame-options", "SAMEORIGIN") However, I know that not all browsers support this header. So, I want to add some additional javascript sollution. As I am not expert in javascript, I have found the following sollution: <script> if (self == top) { var theBody = document

Busting a tough FRAME killer

由 偶尔善良 提交于 2019-12-01 13:21:29
I've been trying to break this up for a few hours now but with no success... I am pretty desperate now :( I am doing penetration testing for a company and I need to bypass this frame killer JS: <script type="text/javascript">/* <![CDATA[ */ if (top != self) { try { if (parent != top) { throw 1; } var disallowed = ['XXXXXXX.com']; var href = top.location.href.toLowerCase(); for (var i = 0; i < disallowed.length; i++) { if (href.indexOf(disallowed[i]) >= 0) { throw 1; } } } catch (e) { try { window.document.getElementsByTagName('head')[0].innerHTML = ''; } catch (e) { /* IE */ var htmlEl =

Busting a tough FRAME killer

由 我只是一个虾纸丫 提交于 2019-12-01 11:37:43
问题 I've been trying to break this up for a few hours now but with no success... I am pretty desperate now :( I am doing penetration testing for a company and I need to bypass this frame killer JS: <script type="text/javascript">/* <![CDATA[ */ if (top != self) { try { if (parent != top) { throw 1; } var disallowed = ['XXXXXXX.com']; var href = top.location.href.toLowerCase(); for (var i = 0; i < disallowed.length; i++) { if (href.indexOf(disallowed[i]) >= 0) { throw 1; } } } catch (e) { try {

Xframe option in tomcat 7

由 試著忘記壹切 提交于 2019-11-30 07:27:39
问题 I have added the below code snippet in my tomcat web.xml to prevent clickjacking. In the section to add built-in filter, I have added <filter> <filter-name>httpHeaderSecurity</filter-name> <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class> <init-param> <param-name>antiClickJackingOption</param-name> <param-value>SAMEORIGIN</param-value> </init-param> </filter> For filter-mapping part I have added. <filter-mapping> <filter-name>httpHeaderSecurity</filter-name>

X-Frame-Options on apache

由 被刻印的时光 ゝ 提交于 2019-11-28 21:10:39
I am trying to allow some particular domain to access my site via iframe Header set X-Frame-Options ALLOW-FROM https://www.that-site.com I know this could be done by add the line above to the config of Apache server. Two questions here. 1) which config file should be added to? The apache running on both Unix and windows, if not the same file 2) while enable the all-from, I still want to be able to run some iframe from my own domain. Can I just add the following line after the allow-from? Header set X-Frame-Options SAMEORIGIN Or I should just add my own domain in the all-from, ie Header set X

How to protect widgets from forged requests

由 你。 提交于 2019-11-28 10:50:39
Lets say you have a JavaScript widget which needs to fire off a request to your web application if and only if the user wants to click on it. You don't want this request to be vulnerable to CSRF so you write an iframe to the page. Based on the origin inheritance rules the parent site won't be able to read the CSRF token. However what about clickjacking (or likejacking )? Because of CSRF you must be within an iframe and there for the x-frame-options cannot help, and the same holds true for frame-busters . The attacker is going to apply an SVG mask the iframe after the widget has loaded. This
订阅 clickjacking